@flusys/nestjs-shared 9.1.2 → 9.2.0

package/fesm/utils/index.js

@@ -1,451 +1,11 @@
-import * as __rspack_external__flusys_nestjs_core_config_197fa0a9 from "@flusys/nestjs-core/config";
-import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
 import * as __rspack_external_crypto from "crypto";
+import * as __rspack_external_typeorm from "typeorm";
 export const __rspack_esm_id = 152;
 export const __rspack_esm_ids = [152];
 export const __webpack_modules__ = {
-43(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _permissions_js__rspack_import_0 = __webpack_require__(975);
-/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(389);
-// Metadata keys
-const IS_PUBLIC_KEY = 'isPublic';
-const PERMISSIONS_KEY = 'permissions';
-const DOMAIN_EVENT_HANDLER_KEY = 'domainEventHandler';
-// Injection tokens
-const CACHE_INSTANCE = 'CACHE_INSTANCE';
-const PERMISSION_GUARD_CONFIG = 'PERMISSION_GUARD_CONFIG';
-const EVENT_BUS_INSTANCE = 'EVENT_BUS_INSTANCE';
-const EVENT_BUS_MODULE_OPTIONS = 'EVENT_BUS_MODULE_OPTIONS';
-// Header names
-const IDEMPOTENCY_KEY_HEADER = 'x-idempotency-key';
-const REQUEST_ID_HEADER = 'x-request-id';
-const CLIENT_TYPE_HEADER = 'x-client-type';
-// Cache key prefixes
-const PERMISSIONS_CACHE_PREFIX = 'my-permissions';
-const IDEMPOTENCY_CACHE_PREFIX = 'idempotency';
-// Event bus defaults
-const DEFAULT_EVENT_EXCHANGE = 'flusys.events';
-const DEFAULT_EVENT_TOPIC = 'flusys.domain-events';
-const DEFAULT_EVENT_SERVICE_NAME = 'flusys';
-// Permission codes
-
-// Message keys for localization
-
-
-__webpack_require__.d(__webpack_exports__, {
-  BC: () => (/* reexport safe */ _permissions_js__rspack_import_0.BC),
-  Bz: () => (/* reexport safe */ _permissions_js__rspack_import_0.Bz),
-  DP: () => (/* reexport safe */ _permissions_js__rspack_import_0.DP),
-  Em: () => (/* reexport safe */ _permissions_js__rspack_import_0.Em),
-  G0: () => (/* reexport safe */ _permissions_js__rspack_import_0.G0),
-  GH: () => (/* reexport safe */ _permissions_js__rspack_import_0.GH),
-  GT: () => (/* reexport safe */ _permissions_js__rspack_import_0.GT),
-  Jj: () => (/* reexport safe */ _permissions_js__rspack_import_0.Jj),
-  N3: () => (/* reexport safe */ _permissions_js__rspack_import_0.N3),
-  ON: () => (/* reexport safe */ _permissions_js__rspack_import_0.ON),
-  P0: () => (/* reexport safe */ _permissions_js__rspack_import_0.P0),
-  Q5: () => (/* reexport safe */ _permissions_js__rspack_import_0.Q5),
-  S6: () => (/* reexport safe */ _permissions_js__rspack_import_0.S6),
-  T: () => (/* reexport safe */ _permissions_js__rspack_import_0.T),
-  UB: () => (/* reexport safe */ _permissions_js__rspack_import_0.UB),
-  UG: () => (/* reexport safe */ _permissions_js__rspack_import_0.UG),
-  UU: () => (/* reexport safe */ _message_keys_js__rspack_import_1.UU),
-  Ub: () => (/* reexport safe */ _permissions_js__rspack_import_0.Ub),
-  V0: () => (/* reexport safe */ _permissions_js__rspack_import_0.V0),
-  Wc: () => (/* reexport safe */ _permissions_js__rspack_import_0.Wc),
-  Y3: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y3),
-  Y7: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y7),
-  _X: () => (/* reexport safe */ _permissions_js__rspack_import_0._X),
-  aO: () => (/* reexport safe */ _permissions_js__rspack_import_0.aO),
-  aT: () => (/* reexport safe */ _permissions_js__rspack_import_0.aT),
-  fS: () => (/* reexport safe */ _permissions_js__rspack_import_0.fS),
-  hg: () => (/* reexport safe */ _message_keys_js__rspack_import_1.hg),
-  kA: () => (/* reexport safe */ _permissions_js__rspack_import_0.kA),
-  kd: () => (/* reexport safe */ _permissions_js__rspack_import_0.kd),
-  l3: () => (/* reexport safe */ _permissions_js__rspack_import_0.l3),
-  mK: () => (/* reexport safe */ _message_keys_js__rspack_import_1.mK),
-  mV: () => (/* reexport safe */ _permissions_js__rspack_import_0.mV),
-  rH: () => (/* reexport safe */ _permissions_js__rspack_import_0.rH),
-  t$: () => (/* reexport safe */ _permissions_js__rspack_import_0.t$),
-  w7: () => (/* reexport safe */ _permissions_js__rspack_import_0.w7),
-  wA: () => (/* reexport safe */ _permissions_js__rspack_import_0.wA),
-  wM: () => (/* reexport safe */ _permissions_js__rspack_import_0.wM),
-  z$: () => (/* reexport safe */ _permissions_js__rspack_import_0.z$),
-  zd: () => (/* reexport safe */ _permissions_js__rspack_import_0.zd)
-}, {
-  Hq: DEFAULT_EVENT_EXCHANGE,
-  Lw: PERMISSION_GUARD_CONFIG,
-  N7: PERMISSIONS_KEY,
-  PT: DOMAIN_EVENT_HANDLER_KEY,
-  Qj: EVENT_BUS_INSTANCE,
-  SL: EVENT_BUS_MODULE_OPTIONS,
-  fG: PERMISSIONS_CACHE_PREFIX,
-  iH: IDEMPOTENCY_KEY_HEADER,
-  jA: IS_PUBLIC_KEY,
-  kC: REQUEST_ID_HEADER,
-  mg: IDEMPOTENCY_CACHE_PREFIX,
-  nx: DEFAULT_EVENT_TOPIC,
-  xw: CLIENT_TYPE_HEADER,
-  zl: CACHE_INSTANCE
-});
-
-
-},
-389(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-// ==================== AUTH (Shared across guards/interceptors) ====================
-// These are duplicated in nestjs-auth but needed here to avoid circular dependencies
-const AUTH_MESSAGES = {
-    TOKEN_REQUIRED: 'auth.token.required',
-    TOKEN_INVALID: 'auth.token.invalid',
-    ENTITY_BELOG_ANOTHER_COMPANY: 'entity.belongs.another.company',
-    COMPANY_NO_ACCESS: 'auth.company.no.access'
-};
-// ==================== ERROR (HTTP Exceptions) ====================
-const ERROR_MESSAGES = {
-    NOT_FOUND: 'error.not.found',
-    VALIDATION: 'error.validation',
-    UNAUTHORIZED: 'error.unauthorized',
-    FORBIDDEN: 'error.forbidden',
-    CONFLICT: 'error.conflict',
-    DB_FOREIGN_KEY: 'error.db.foreign.key',
-    DB_NOT_NULL: 'error.db.not.null',
-    DB_INVALID_INPUT: 'error.db.invalid.input',
-    DB_VALUE_TOO_LONG: 'error.db.value.too.long',
-    DB_CHECK_CONSTRAINT: 'error.db.check.constraint',
-    DB_DEADLOCK: 'error.db.deadlock',
-    INTERNAL: 'error.internal',
-    SERVICE_UNAVAILABLE: 'error.service.unavailable',
-    UNKNOWN: 'error.unknown',
-    HTTP: 'error.http',
-    GENERIC: 'error.generic',
-    PERMISSION_SYSTEM_UNAVAILABLE: 'error.permission.system.unavailable',
-    INSUFFICIENT_PERMISSIONS: 'error.insufficient.permissions',
-    INSUFFICIENT_PERMISSIONS_OR: 'error.insufficient.permissions.or',
-    NO_PERMISSIONS_FOUND: 'error.no.permissions.found',
-    ENDPOINT_DISABLED: 'error.endpoint.disabled'
-};
-// ==================== SYSTEM (Infrastructure) ====================
-const SYSTEM_MESSAGES = {
-    REPOSITORY_NOT_AVAILABLE: 'system.repository.not.available',
-    DATASOURCE_NOT_AVAILABLE: 'system.datasource.not.available',
-    DATABASE_CONFIG_NOT_AVAILABLE: 'system.database.config.not.available',
-    SERVICE_NOT_AVAILABLE: 'system.service.not.available',
-    CONFIG_REQUIRED: 'system.config.required',
-    INTERNAL_ERROR: 'system.internal.error',
-    DUPLICATE_REQUEST: 'system.duplicate.request',
-    INVALID_TENANT_ID: 'system.invalid.tenant.id',
-    TENANT_NOT_FOUND: 'system.tenant.not.found',
-    TENANT_HEADER_REQUIRED: 'system.tenant.header.required',
-    MISSING_PARAMETER: 'system.missing.parameter',
-    SDK_NOT_INSTALLED: 'system.sdk.not.installed',
-    PATH_TRAVERSAL_DETECTED: 'system.path.traversal.detected',
-    INVALID_FILE_KEY: 'system.invalid.file.key'
-};
-
-__webpack_require__.d(__webpack_exports__, {
-}, {
-  UU: ERROR_MESSAGES,
-  hg: SYSTEM_MESSAGES,
-  mK: AUTH_MESSAGES
-});
-
-
-},
-975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-// ==================== AUTH MODULE ====================
-const USER_PERMISSIONS = {
-    CREATE: 'user.create',
-    READ: 'user.read',
-    UPDATE: 'user.update',
-    DELETE: 'user.delete',
-    LOOKUP: 'user.lookup'
-};
-const COMPANY_PERMISSIONS = {
-    CREATE: 'company.create',
-    READ: 'company.read',
-    UPDATE: 'company.update',
-    DELETE: 'company.delete'
-};
-const BRANCH_PERMISSIONS = {
-    CREATE: 'branch.create',
-    READ: 'branch.read',
-    UPDATE: 'branch.update',
-    DELETE: 'branch.delete'
-};
-const SOCIAL_AUTH_CONFIG_PERMISSIONS = {
-    CREATE: 'social-config.create',
-    READ: 'social-config.read',
-    UPDATE: 'social-config.update',
-    DELETE: 'social-config.delete'
-};
-// ==================== IAM MODULE ====================
-const ACTION_PERMISSIONS = {
-    CREATE: 'action.create',
-    READ: 'action.read',
-    UPDATE: 'action.update',
-    DELETE: 'action.delete'
-};
-const ROLE_PERMISSIONS = {
-    CREATE: 'role.create',
-    READ: 'role.read',
-    UPDATE: 'role.update',
-    DELETE: 'role.delete'
-};
-const ROLE_ACTION_PERMISSIONS = {
-    READ: 'role-action.read',
-    ASSIGN: 'role-action.assign'
-};
-const USER_ROLE_PERMISSIONS = {
-    READ: 'user-role.read',
-    ASSIGN: 'user-role.assign'
-};
-const USER_ACTION_PERMISSIONS = {
-    READ: 'user-action.read',
-    ASSIGN: 'user-action.assign'
-};
-const COMPANY_ACTION_PERMISSIONS = {
-    READ: 'company-action.read',
-    ASSIGN: 'company-action.assign'
-};
-// ==================== STORAGE MODULE ====================
-const FILE_PERMISSIONS = {
-    CREATE: 'file.create',
-    READ: 'file.read',
-    UPDATE: 'file.update',
-    DELETE: 'file.delete',
-    VIEW_PRIVATE_ACTION: 'file.view.private'
-};
-const FOLDER_PERMISSIONS = {
-    CREATE: 'folder.create',
-    READ: 'folder.read',
-    UPDATE: 'folder.update',
-    DELETE: 'folder.delete'
-};
-const STORAGE_CONFIG_PERMISSIONS = {
-    CREATE: 'storage-config.create',
-    READ: 'storage-config.read',
-    UPDATE: 'storage-config.update',
-    DELETE: 'storage-config.delete'
-};
-const UPLOAD_CONFIG_PERMISSIONS = {
-    DELETE: 'upload-config.delete'
-};
-// ==================== EMAIL MODULE ====================
-const EMAIL_CONFIG_PERMISSIONS = {
-    CREATE: 'email-config.create',
-    READ: 'email-config.read',
-    UPDATE: 'email-config.update',
-    DELETE: 'email-config.delete'
-};
-const EMAIL_TEMPLATE_PERMISSIONS = {
-    CREATE: 'email-template.create',
-    READ: 'email-template.read',
-    UPDATE: 'email-template.update',
-    DELETE: 'email-template.delete'
-};
-// ==================== FORM BUILDER MODULE ====================
-const FORM_PERMISSIONS = {
-    CREATE: 'form.create',
-    READ: 'form.read',
-    UPDATE: 'form.update',
-    DELETE: 'form.delete'
-};
-const FORM_RESULT_PERMISSIONS = {
-    CREATE: 'form-result.create',
-    READ: 'form-result.read',
-    UPDATE: 'form-result.update',
-    DELETE: 'form-result.delete'
-};
-// ==================== ENTITY BUILDER MODULE ====================
-// Static metadata permissions only. Per-dynamic-entity record permissions
-// (`entity_builder.entity.<entityCode>.<action>`) are checked by flows running as the caller;
-// ENTITY_BUILDER_ALL_DYNAMIC is the wildcard that grants all of them (and nothing else).
-const ENTITY_DEFINITION_PERMISSIONS = {
-    CREATE: 'entity_builder.entity_definition.create',
-    READ: 'entity_builder.entity_definition.read',
-    UPDATE: 'entity_builder.entity_definition.update',
-    DELETE: 'entity_builder.entity_definition.delete'
-};
-const FIELD_DEFINITION_PERMISSIONS = {
-    READ: 'entity_builder.field_definition.read',
-    UPDATE: 'entity_builder.field_definition.update'
-};
-const FLOW_DEFINITION_PERMISSIONS = {
-    CREATE: 'entity_builder.flow_definition.create',
-    READ: 'entity_builder.flow_definition.read',
-    UPDATE: 'entity_builder.flow_definition.update',
-    DELETE: 'entity_builder.flow_definition.delete',
-    TEST: 'entity_builder.flow_definition.test',
-    /** Needed to save a flow containing a code node (sandboxed JavaScript). */ CODE: 'entity_builder.flow_definition.code'
-};
-const ENTITY_BUILDER_DYNAMIC_PREFIX = 'entity_builder.entity';
-const ENTITY_BUILDER_ALL_DYNAMIC = {
-    ALL: `${ENTITY_BUILDER_DYNAMIC_PREFIX}.*`
-};
-const dynamicEntityPermissionParent = (entityCode)=>`${ENTITY_BUILDER_DYNAMIC_PREFIX}.${entityCode}`;
-const dynamicEntityPermission = (entityCode, action)=>`${dynamicEntityPermissionParent(entityCode)}.${action}`;
-// ==================== EVENT MANAGER MODULE ====================
-const EVENT_PERMISSIONS = {
-    CREATE: 'event.create',
-    READ: 'event.read',
-    UPDATE: 'event.update',
-    DELETE: 'event.delete'
-};
-// ==================== NOTIFICATION MODULE ====================
-const NOTIFICATION_PERMISSIONS = {
-    CREATE: 'notification.create',
-    READ: 'notification.read',
-    UPDATE: 'notification.update',
-    DELETE: 'notification.delete'
-};
-// ==================== LOCALIZATION MODULE ====================
-const LANGUAGE_PERMISSIONS = {
-    CREATE: 'language.create',
-    READ: 'language.read',
-    UPDATE: 'language.update',
-    DELETE: 'language.delete'
-};
-const TRANSLATION_KEY_PERMISSIONS = {
-    CREATE: 'translation-key.create',
-    READ: 'translation-key.read',
-    UPDATE: 'translation-key.update',
-    DELETE: 'translation-key.delete'
-};
-const TRANSLATION_PERMISSIONS = {
-    CREATE: 'translation.create',
-    READ: 'translation.read',
-    UPDATE: 'translation.update',
-    DELETE: 'translation.delete'
-};
-// ==================== TASK MANAGER MODULE ====================
-const TASK_BOARD_PERMISSIONS = {
-    CREATE: 'task-board.create',
-    READ: 'task-board.read',
-    UPDATE: 'task-board.update',
-    DELETE: 'task-board.delete',
-    MANAGE_MEMBERS: 'task-board.manage-members'
-};
-const TASK_LIST_PERMISSIONS = {
-    CREATE: 'task-list.create',
-    READ: 'task-list.read',
-    UPDATE: 'task-list.update',
-    DELETE: 'task-list.delete'
-};
-const TASK_PERMISSIONS = {
-    CREATE: 'task.create',
-    READ: 'task.read',
-    UPDATE: 'task.update',
-    DELETE: 'task.delete',
-    MOVE: 'task.move',
-    ASSIGN: 'task.assign'
-};
-const TASK_LABEL_PERMISSIONS = {
-    CREATE: 'task-label.create',
-    READ: 'task-label.read',
-    UPDATE: 'task-label.update',
-    DELETE: 'task-label.delete'
-};
-const TASK_COMMENT_PERMISSIONS = {
-    CREATE: 'task-comment.create',
-    READ: 'task-comment.read',
-    DELETE: 'task-comment.delete'
-};
-// ==================== AI ASSISTANT MODULE ====================
-const AI_ASSISTANT_PERMISSIONS = {
-    VIEW_ALL_HISTORY: 'ai-assistant.view-all-history'
-};
-// ==================== AGGREGATED EXPORTS ====================
-const PERMISSIONS = {
-    // Auth
-    USER: USER_PERMISSIONS,
-    COMPANY: COMPANY_PERMISSIONS,
-    BRANCH: BRANCH_PERMISSIONS,
-    SOCIAL_AUTH_CONFIG: SOCIAL_AUTH_CONFIG_PERMISSIONS,
-    // IAM
-    ACTION: ACTION_PERMISSIONS,
-    ROLE: ROLE_PERMISSIONS,
-    ROLE_ACTION: ROLE_ACTION_PERMISSIONS,
-    USER_ROLE: USER_ROLE_PERMISSIONS,
-    USER_ACTION: USER_ACTION_PERMISSIONS,
-    COMPANY_ACTION: COMPANY_ACTION_PERMISSIONS,
-    // Storage
-    FILE: FILE_PERMISSIONS,
-    FOLDER: FOLDER_PERMISSIONS,
-    STORAGE_CONFIG: STORAGE_CONFIG_PERMISSIONS,
-    // Email
-    EMAIL_CONFIG: EMAIL_CONFIG_PERMISSIONS,
-    EMAIL_TEMPLATE: EMAIL_TEMPLATE_PERMISSIONS,
-    // Form Builder
-    FORM: FORM_PERMISSIONS,
-    FORM_RESULT: FORM_RESULT_PERMISSIONS,
-    // Entity Builder
-    ENTITY_DEFINITION: ENTITY_DEFINITION_PERMISSIONS,
-    FIELD_DEFINITION: FIELD_DEFINITION_PERMISSIONS,
-    FLOW_DEFINITION: FLOW_DEFINITION_PERMISSIONS,
-    ENTITY_BUILDER_ALL_DYNAMIC: ENTITY_BUILDER_ALL_DYNAMIC,
-    // Event Manager
-    EVENT: EVENT_PERMISSIONS,
-    // Notification
-    NOTIFICATION: NOTIFICATION_PERMISSIONS,
-    // Localization
-    LANGUAGE: LANGUAGE_PERMISSIONS,
-    TRANSLATION_KEY: TRANSLATION_KEY_PERMISSIONS,
-    TRANSLATION: TRANSLATION_PERMISSIONS,
-    // Task Manager
-    TASK_BOARD: TASK_BOARD_PERMISSIONS,
-    TASK_LIST: TASK_LIST_PERMISSIONS,
-    TASK: TASK_PERMISSIONS,
-    TASK_LABEL: TASK_LABEL_PERMISSIONS,
-    TASK_COMMENT: TASK_COMMENT_PERMISSIONS,
-    // AI Assistant
-    AI_ASSISTANT: AI_ASSISTANT_PERMISSIONS
-};
-
-__webpack_require__.d(__webpack_exports__, {
-}, {
-  BC: USER_PERMISSIONS,
-  Bz: AI_ASSISTANT_PERMISSIONS,
-  DP: ENTITY_DEFINITION_PERMISSIONS,
-  Em: STORAGE_CONFIG_PERMISSIONS,
-  G0: ENTITY_BUILDER_ALL_DYNAMIC,
-  GH: dynamicEntityPermissionParent,
-  GT: FORM_RESULT_PERMISSIONS,
-  Jj: PERMISSIONS,
-  N3: TRANSLATION_KEY_PERMISSIONS,
-  ON: TASK_LIST_PERMISSIONS,
-  P0: ROLE_ACTION_PERMISSIONS,
-  Q5: LANGUAGE_PERMISSIONS,
-  S6: FILE_PERMISSIONS,
-  T: TASK_PERMISSIONS,
-  UB: UPLOAD_CONFIG_PERMISSIONS,
-  UG: TASK_LABEL_PERMISSIONS,
-  Ub: EVENT_PERMISSIONS,
-  V0: EMAIL_CONFIG_PERMISSIONS,
-  Wc: FORM_PERMISSIONS,
-  Y3: TASK_BOARD_PERMISSIONS,
-  Y7: ACTION_PERMISSIONS,
-  _X: USER_ACTION_PERMISSIONS,
-  aO: COMPANY_ACTION_PERMISSIONS,
-  aT: dynamicEntityPermission,
-  fS: TRANSLATION_PERMISSIONS,
-  kA: FIELD_DEFINITION_PERMISSIONS,
-  kd: FLOW_DEFINITION_PERMISSIONS,
-  l3: SOCIAL_AUTH_CONFIG_PERMISSIONS,
-  mV: ROLE_PERMISSIONS,
-  rH: NOTIFICATION_PERMISSIONS,
-  t$: COMPANY_PERMISSIONS,
-  w7: USER_ROLE_PERMISSIONS,
-  wA: BRANCH_PERMISSIONS,
-  wM: FOLDER_PERMISSIONS,
-  z$: EMAIL_TEMPLATE_PERMISSIONS,
-  zd: TASK_COMMENT_PERMISSIONS
-});
-
-
-},
-374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(389);
+8374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(4389);
 
 
 class PermissionSystemUnavailableException extends _nestjs_common__rspack_import_0.InternalServerErrorException {
@@ -490,7 +50,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-154(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+8154(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * The tenant a cache key belongs to: the provider's current tenant in multi-tenant mode, else
  * undefined. A single database never prefixes, so a stray tenant header cannot split its cache.
@@ -505,7 +65,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-456(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+8456(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 const SENSITIVE_KEYS = [
     'password',
     'secret',
@@ -543,25 +103,27 @@ const MAX_DEPTH = 8;
  * `*` matches exactly one segment, `#` and `**` match zero or more segments.
  */ function matchEventPattern(pattern, eventName) {
     if (pattern === eventName) return true;
-    const patternSegments = pattern.split('.');
-    const nameSegments = eventName.split('.');
-    return matchSegments(patternSegments, 0, nameSegments, 0);
+    return matchSegments(pattern.split('.'), eventName.split('.'));
 }
 function isMultiWildcard(segment) {
     return segment === '#' || segment === '**';
 }
-function matchSegments(pattern, patternIndex, name, nameIndex) {
-    if (patternIndex === pattern.length) return nameIndex === name.length;
-    const segment = pattern[patternIndex];
-    if (isMultiWildcard(segment)) {
-        for(let skip = nameIndex; skip <= name.length; skip++){
-            if (matchSegments(pattern, patternIndex + 1, name, skip)) return true;
+/** Linear in pattern x name length: each (pattern, name) position is decided once, however many `#` there are. */ function matchSegments(pattern, name) {
+    let matches = new Array(name.length + 1).fill(false);
+    matches[name.length] = true;
+    for(let p = pattern.length - 1; p >= 0; p--){
+        const segment = pattern[p];
+        const next = new Array(name.length + 1).fill(false);
+        for(let n = name.length; n >= 0; n--){
+            if (isMultiWildcard(segment)) {
+                next[n] = matches[n] || n < name.length && next[n + 1];
+            } else {
+                next[n] = n < name.length && (segment === '*' || segment === name[n]) && matches[n + 1];
+            }
         }
-        return false;
+        matches = next;
     }
-    if (nameIndex === name.length) return false;
-    if (segment !== '*' && segment !== name[nameIndex]) return false;
-    return matchSegments(pattern, patternIndex + 1, name, nameIndex + 1);
+    return matches[0];
 }
 /**
  * Strips credential-like fields before a row leaves the process on an event.
@@ -592,13 +154,14 @@ function sanitizeValue(value, ancestors, depth) {
         ancestors.delete(value);
     }
 }
-function isSensitiveKey(key) {
-    const lowered = key.toLowerCase();
-    if (SENSITIVE_EXACT_KEYS.includes(lowered)) return true;
-    return SENSITIVE_KEYS.some((sensitive)=>lowered.includes(sensitive));
+/** Case and separator blind, so `apiKey`, `api_key`, `X-API-KEY` and `private-key` all match. */ function isSensitiveKey(key) {
+    const normalized = key.toLowerCase().replace(/[\s_.-]/g, '');
+    if (SENSITIVE_EXACT_KEYS.includes(normalized)) return true;
+    return SENSITIVE_KEYS.some((sensitive)=>normalized.includes(sensitive));
 }
 
 __webpack_require__.d(__webpack_exports__, {
+  Gd: () => (isSensitiveKey),
   IN: () => (sanitizeEventPayload),
   _c: () => (isMultiWildcard),
   qe: () => (matchEventPattern)
@@ -606,8 +169,10 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(43);
+3199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(6043);
+/* import */ var _middlewares_logger_middleware_js__rspack_import_1 = __webpack_require__(8244);
+
 
 const DEFAULT_USER_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:user:{userId}`;
 const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:company:{companyId}:branch:{branchId}:user:{userId}`;
@@ -618,9 +183,31 @@ const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_imp
     }
     return (config?.userPermissionKeyFormat || DEFAULT_USER_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId);
 }
+/**
+ * Tenant databases can share user ids (they are cloned from one template), so multi-tenant keys
+ * carry the request's tenant. A single database never does: a stray tenant header must not move
+ * a user onto a cache entry that invalidation never reaches.
+ */ function permissionTenant(config) {
+    return config?.multiTenant ? `tenant:${(0,_middlewares_logger_middleware_js__rspack_import_1/* .getTenantId */.EO)() ?? 'none'}:` : '';
+}
+function permissionStampName(userId, config) {
+    return `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:${permissionTenant(config)}user:${userId}`;
+}
+/**
+ * The key a user's permissions are cached under right now: tenant + scope + the user's version
+ * stamp. Resolve it once, BEFORE reading grants from the database, and write under that same key.
+ */ async function resolvePermissionCacheKey(cache, options, config) {
+    const stamp = await cache.getStamp(permissionStampName(options.userId, config));
+    return `${permissionTenant(config)}${buildPermissionCacheKey(options, config)}:v:${stamp}`;
+}
+/** Drops every cached permission scope (each company and branch) of the user, on every instance */ async function invalidatePermissionCache(cache, userId, config) {
+    await cache.bumpStamp(permissionStampName(userId, config));
+}
 
 __webpack_require__.d(__webpack_exports__, {
-  nt: () => (buildPermissionCacheKey)
+  Rw: () => (resolvePermissionCacheKey),
+  nt: () => (buildPermissionCacheKey),
+  xp: () => (invalidatePermissionCache)
 }, {
   q6: DEFAULT_USER_PERMISSION_KEY_FORMAT,
   s8: DEFAULT_COMPANY_PERMISSION_KEY_FORMAT
@@ -629,7 +216,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(374);
+/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(8374);
 
 /** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
     if (granted.includes(required)) return true;
@@ -710,21 +297,89 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-307(module) {
+3366(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * URL-friendly slug: lower case, words joined by single hyphens. Latin accents are folded
+ * (`Café` -> `cafe`) and letters of other scripts are kept, so a non-Latin name never
+ * collapses to an empty slug. Never starts or ends with a hyphen, also after truncation.
+ *
+ * @example
+ * generateSlug('My Company Name') // 'my-company-name'
+ * generateSlug('Hello World!') // 'hello-world'
+ */ function generateSlug(text, maxLength = 100) {
+    const slug = text.normalize('NFKD').toLowerCase().replace(/([a-z0-9])\p{M}+/gu, '$1').replace(/[^\p{L}\p{N}\p{M}\s-]/gu, '').trim().replace(/[\s-]+/g, '-').replace(/^-+|-+$/g, '').normalize('NFC');
+    return Array.from(slug).slice(0, Math.max(maxLength, 0)).join('').replace(/-+$/, '');
+}
+/**
+ * Generate unique slug using single database query (optimized for large datasets)
+ * Appends numeric suffix if collision exists (e.g., 'my-company-1', 'my-company-2')
+ *
+ * Performance: O(1) database query regardless of collision count
+ * - Works efficiently with millions of records
+ * - Requires index on slug column for best performance
+ *
+ * @param text - The text to convert to slug
+ * @param findMatchingSlugs - Async function that returns all slugs matching base pattern
+ *                            Should query: WHERE slug = baseSlug OR slug LIKE 'baseSlug-%'
+ * @param maxLength - Maximum length of the base slug (default: 100)
+ * @returns Unique URL-friendly slug
+ *
+ * @example
+ * const slug = await generateUniqueSlug('My Company', async (baseSlug) => {
+ *   return repo
+ *     .createQueryBuilder('c')
+ *     .select('c.slug')
+ *     .where('c.slug = :base OR c.slug LIKE :pattern', {
+ *       base: baseSlug,
+ *       pattern: `${baseSlug}-%`,
+ *     })
+ *     .getMany()
+ *     .then(rows => rows.map(r => r.slug));
+ * });
+ */ async function generateUniqueSlug(text, findMatchingSlugs, maxLength = 100) {
+    const baseSlug = generateSlug(text, maxLength);
+    // Single query to get all matching slugs
+    const existingSlugs = await findMatchingSlugs(baseSlug);
+    // No collisions - base slug is available
+    if (existingSlugs.length === 0) {
+        return baseSlug;
+    }
+    // Build set for O(1) lookup
+    const existingSet = new Set(existingSlugs);
+    // Base slug not taken (only suffixed versions exist)
+    if (!existingSet.has(baseSlug)) {
+        return baseSlug;
+    }
+    // Find next available suffix in memory (fast)
+    let counter = 1;
+    while(counter < 10000){
+        const slugWithSuffix = `${baseSlug}-${counter}`;
+        if (!existingSet.has(slugWithSuffix)) {
+            return slugWithSuffix;
+        }
+        counter++;
+    }
+    // Fallback: append random string (extremely rare edge case)
+    const randomSuffix = Math.random().toString(36).substring(2, 8);
+    return `${baseSlug}-${randomSuffix}`;
+}
 
-module.exports = __rspack_external__flusys_nestjs_core_config_197fa0a9;
+__webpack_require__.d(__webpack_exports__, {
+  o: () => (generateUniqueSlug),
+  z: () => (generateSlug)
+});
 
 
 },
-157(module) {
+7823(module) {
 
-module.exports = __rspack_external__nestjs_common_a04939da;
+module.exports = __rspack_external_crypto;
 
 
 },
-823(module) {
+7158(module) {
 
-module.exports = __rspack_external_crypto;
+module.exports = __rspack_external_typeorm;
 
 
 },
@@ -732,11 +387,13 @@ module.exports = __rspack_external_crypto;
 };
 import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
-import * as __rspack_chunk_1 from '../282.js';
+import * as __rspack_chunk_1 from '../997.js';
 __webpack_require__.C(__rspack_chunk_1);
-import * as __rspack_chunk_2 from './index.js';
+import * as __rspack_chunk_2 from '../47.js';
 __webpack_require__.C(__rspack_chunk_2);
-var __webpack_exports__ = __webpack_exec__(129);var __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = __webpack_exports__.s8;
+import * as __rspack_chunk_3 from './index.js';
+__webpack_require__.C(__rspack_chunk_3);
+var __webpack_exports__ = __webpack_exec__(4578);var __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = __webpack_exports__.s8;
 var __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT = __webpack_exports__.q6;
 var __webpack_exports__EXPRESSION_FUNCTIONS = __webpack_exports__.Dd;
 var __webpack_exports__EXPRESSION_LIMITS = __webpack_exports__.wj;
@@ -769,14 +426,15 @@ var __webpack_exports__generateSecureToken = __webpack_exports__.sN;
 var __webpack_exports__generateSlug = __webpack_exports__.z9;
 var __webpack_exports__generateUniqueSlug = __webpack_exports__.oo;
 var __webpack_exports__getBranchPath = __webpack_exports__.gN;
-var __webpack_exports__getTodayInTimezone = __webpack_exports__.oB;
 var __webpack_exports__hasCompanyId = __webpack_exports__.f;
 var __webpack_exports__hashToken = __webpack_exports__.QK;
+var __webpack_exports__invalidatePermissionCache = __webpack_exports__.xp;
 var __webpack_exports__isBranchWithin = __webpack_exports__.QU;
 var __webpack_exports__isBrowserRequest = __webpack_exports__.wh;
 var __webpack_exports__isExpired = __webpack_exports__._d;
 var __webpack_exports__isExpressionError = __webpack_exports__.tX;
 var __webpack_exports__isMultiWildcard = __webpack_exports__._c;
+var __webpack_exports__isSensitiveKey = __webpack_exports__.Gd;
 var __webpack_exports__loadOptionalModule = __webpack_exports__.lk;
 var __webpack_exports__loadPermissionCodes = __webpack_exports__.CQ;
 var __webpack_exports__localToUtc = __webpack_exports__.vf;
@@ -787,9 +445,10 @@ var __webpack_exports__normalizeBranchIds = __webpack_exports__.Ty;
 var __webpack_exports__parseDurationToMs = __webpack_exports__.Ju;
 var __webpack_exports__permissionLogicCodes = __webpack_exports__.MO;
 var __webpack_exports__permissionLogicProblem = __webpack_exports__.HU;
+var __webpack_exports__resolvePermissionCacheKey = __webpack_exports__.Rw;
 var __webpack_exports__safeRegexProblem = __webpack_exports__._X;
 var __webpack_exports__sanitizeEventPayload = __webpack_exports__.IN;
 var __webpack_exports__utcToLocal = __webpack_exports__.v4;
 var __webpack_exports__validateCompanyOwnership = __webpack_exports__.bE;
 var __webpack_exports__withSavepoint = __webpack_exports__.o0;
-export { __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT as DEFAULT_COMPANY_PERMISSION_KEY_FORMAT, __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT as DEFAULT_USER_PERMISSION_KEY_FORMAT, __webpack_exports__EXPRESSION_FUNCTIONS as EXPRESSION_FUNCTIONS, __webpack_exports__EXPRESSION_LIMITS as EXPRESSION_LIMITS, __webpack_exports__ExpressionError as ExpressionError, __webpack_exports__MAX_PERMISSION_LOGIC_CODES as MAX_PERMISSION_LOGIC_CODES, __webpack_exports__MAX_PERMISSION_LOGIC_DEPTH as MAX_PERMISSION_LOGIC_DEPTH, __webpack_exports__SAFE_REGEX_LIMITS as SAFE_REGEX_LIMITS, __webpack_exports__applyBranchFilter as applyBranchFilter, __webpack_exports__applyCompanyFilter as applyCompanyFilter, __webpack_exports__assertValidConditionGroup as assertValidConditionGroup, __webpack_exports__assertValidExpression as assertValidExpression, __webpack_exports__buildCompanyWhereCondition as buildCompanyWhereCondition, __webpack_exports__buildCookieOptions as buildCookieOptions, __webpack_exports__buildFrontendUrl as buildFrontendUrl, __webpack_exports__buildPermissionCacheKey as buildPermissionCacheKey, __webpack_exports__cacheTenantId as cacheTenantId, __webpack_exports__collectBranchAncestorIds as collectBranchAncestorIds, __webpack_exports__collectBranchDescendantIds as collectBranchDescendantIds, __webpack_exports__compileSafeRegex as compileSafeRegex, __webpack_exports__escapeHtml as escapeHtml, __webpack_exports__escapeHtmlVariables as escapeHtmlVariables, __webpack_exports__evaluateConditionGroup as evaluateConditionGroup, __webpack_exports__evaluateExpression as evaluateExpression, __webpack_exports__evaluatePermissionLogic as evaluatePermissionLogic, __webpack_exports__expressionToNumber as expressionToNumber, __webpack_exports__expressionToText as expressionToText, __webpack_exports__extractFrontendUrl as extractFrontendUrl, __webpack_exports__formatInTimezone as formatInTimezone, __webpack_exports__generateSecureToken as generateSecureToken, __webpack_exports__generateSlug as generateSlug, __webpack_exports__generateUniqueSlug as generateUniqueSlug, __webpack_exports__getBranchPath as getBranchPath, __webpack_exports__getTodayInTimezone as getTodayInTimezone, __webpack_exports__hasCompanyId as hasCompanyId, __webpack_exports__hashToken as hashToken, __webpack_exports__isBranchWithin as isBranchWithin, __webpack_exports__isBrowserRequest as isBrowserRequest, __webpack_exports__isExpired as isExpired, __webpack_exports__isExpressionError as isExpressionError, __webpack_exports__isMultiWildcard as isMultiWildcard, __webpack_exports__loadOptionalModule as loadOptionalModule, __webpack_exports__loadPermissionCodes as loadPermissionCodes, __webpack_exports__localToUtc as localToUtc, __webpack_exports__matchEventPattern as matchEventPattern, __webpack_exports__matchesPermission as matchesPermission, __webpack_exports__messageRef as messageRef, __webpack_exports__normalizeBranchIds as normalizeBranchIds, __webpack_exports__parseDurationToMs as parseDurationToMs, __webpack_exports__permissionLogicCodes as permissionLogicCodes, __webpack_exports__permissionLogicProblem as permissionLogicProblem, __webpack_exports__safeRegexProblem as safeRegexProblem, __webpack_exports__sanitizeEventPayload as sanitizeEventPayload, __webpack_exports__utcToLocal as utcToLocal, __webpack_exports__validateCompanyOwnership as validateCompanyOwnership, __webpack_exports__withSavepoint as withSavepoint };
+export { __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT as DEFAULT_COMPANY_PERMISSION_KEY_FORMAT, __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT as DEFAULT_USER_PERMISSION_KEY_FORMAT, __webpack_exports__EXPRESSION_FUNCTIONS as EXPRESSION_FUNCTIONS, __webpack_exports__EXPRESSION_LIMITS as EXPRESSION_LIMITS, __webpack_exports__ExpressionError as ExpressionError, __webpack_exports__MAX_PERMISSION_LOGIC_CODES as MAX_PERMISSION_LOGIC_CODES, __webpack_exports__MAX_PERMISSION_LOGIC_DEPTH as MAX_PERMISSION_LOGIC_DEPTH, __webpack_exports__SAFE_REGEX_LIMITS as SAFE_REGEX_LIMITS, __webpack_exports__applyBranchFilter as applyBranchFilter, __webpack_exports__applyCompanyFilter as applyCompanyFilter, __webpack_exports__assertValidConditionGroup as assertValidConditionGroup, __webpack_exports__assertValidExpression as assertValidExpression, __webpack_exports__buildCompanyWhereCondition as buildCompanyWhereCondition, __webpack_exports__buildCookieOptions as buildCookieOptions, __webpack_exports__buildFrontendUrl as buildFrontendUrl, __webpack_exports__buildPermissionCacheKey as buildPermissionCacheKey, __webpack_exports__cacheTenantId as cacheTenantId, __webpack_exports__collectBranchAncestorIds as collectBranchAncestorIds, __webpack_exports__collectBranchDescendantIds as collectBranchDescendantIds, __webpack_exports__compileSafeRegex as compileSafeRegex, __webpack_exports__escapeHtml as escapeHtml, __webpack_exports__escapeHtmlVariables as escapeHtmlVariables, __webpack_exports__evaluateConditionGroup as evaluateConditionGroup, __webpack_exports__evaluateExpression as evaluateExpression, __webpack_exports__evaluatePermissionLogic as evaluatePermissionLogic, __webpack_exports__expressionToNumber as expressionToNumber, __webpack_exports__expressionToText as expressionToText, __webpack_exports__extractFrontendUrl as extractFrontendUrl, __webpack_exports__formatInTimezone as formatInTimezone, __webpack_exports__generateSecureToken as generateSecureToken, __webpack_exports__generateSlug as generateSlug, __webpack_exports__generateUniqueSlug as generateUniqueSlug, __webpack_exports__getBranchPath as getBranchPath, __webpack_exports__hasCompanyId as hasCompanyId, __webpack_exports__hashToken as hashToken, __webpack_exports__invalidatePermissionCache as invalidatePermissionCache, __webpack_exports__isBranchWithin as isBranchWithin, __webpack_exports__isBrowserRequest as isBrowserRequest, __webpack_exports__isExpired as isExpired, __webpack_exports__isExpressionError as isExpressionError, __webpack_exports__isMultiWildcard as isMultiWildcard, __webpack_exports__isSensitiveKey as isSensitiveKey, __webpack_exports__loadOptionalModule as loadOptionalModule, __webpack_exports__loadPermissionCodes as loadPermissionCodes, __webpack_exports__localToUtc as localToUtc, __webpack_exports__matchEventPattern as matchEventPattern, __webpack_exports__matchesPermission as matchesPermission, __webpack_exports__messageRef as messageRef, __webpack_exports__normalizeBranchIds as normalizeBranchIds, __webpack_exports__parseDurationToMs as parseDurationToMs, __webpack_exports__permissionLogicCodes as permissionLogicCodes, __webpack_exports__permissionLogicProblem as permissionLogicProblem, __webpack_exports__resolvePermissionCacheKey as resolvePermissionCacheKey, __webpack_exports__safeRegexProblem as safeRegexProblem, __webpack_exports__sanitizeEventPayload as sanitizeEventPayload, __webpack_exports__utcToLocal as utcToLocal, __webpack_exports__validateCompanyOwnership as validateCompanyOwnership, __webpack_exports__withSavepoint as withSavepoint };